For hosting platforms
Certificate monitoring as a building block of your platform, under your brand.
Your customers' certificates expire where your panel does not reach: third-party CAs, forgotten subdomains, systems next to the panel. SaQura CertWatch runs on your infrastructure, monitors per tenant and sends alerts and reports under your brand, as an add-on you sell.
Why now
of organizations had a certificate-related outage in the last twelve months.
CyberArk, State of Machine Identity Security 2025
Public TLS certificates will be valid for at most 100 days from 2027 and only 47 from 2029. Every reduction multiplies the renewals, and with them the chances of missing one.
CA/Browser Forum, ballot SC-081 (an industry rule, not a law)
Your panel renews what it issued itself. Everything else expires unnoticed: certificates from other issuers, forgotten subdomains, systems next to the panel. That is exactly where the tickets come from.
How it runs on your side
One package, your server, any number of customers, without your customers having to learn a new tool.
On your infrastructure
CertWatch runs self-hosted on your server: Linux, Windows or macOS. Findings and inventory stay with you.
One tenant per customer
Every customer gets their own addresses, recipients and reports. Inventory discovery via the public certificate logs also finds the subdomains that are no longer on any list.
Under your brand
Alerts and reports carry your logo. Your customer sees your platform and never has to log in anywhere.
Connected to your panel
Webhooks report every state change to your systems; the read API delivers inventory and grades for your customer portal or ticket system.
What your customer gets
Three things they do not get from their host today and understand immediately.
Alerts before things fail
30, 14, 7 and 1 day before expiry (configurable), reminders until it is fixed. The all-clear comes only once the new certificate is actually being served.
A recurring report under your brand
A regular report on all of the tenant's addresses with grades A–F and reasons in plain sentences, by e-mail, in English, German or Japanese.
A checksum they can recalculate themselves
Every report carries a protocol number and a checksum recorded in a continuous audit chain. The steps to recalculate it are in the report.
Pricing
The same prices as on the CertWatch page: the basis for pricing your add-on.
MSP monthly
€69/ month
Per managed tenant, cancellable monthly
- Up to 10 tenants €69 per month
- Each additional tenant €6 per month
- From 20 tenants unlimited for €129 per month
- Automatic certificate renewal included
- The license renews itself; change the quantity any time in the customer portal
Self-Host
€1,290/ year
Your server, your data: annual license
- All checks, unlimited addresses
- Tenants, your own brand, webhooks, read API
- Sealed reports + continuous audit chain
- Automatic certificate renewal included
- License file by e-mail, updates during the term
Partner terms
On request
For platforms with many tenants or their own sales channel
- Terms per end customer
- Sample report under your brand
- A named contact at KyotoTech
All prices excl. VAT. Buy, renew and download on the CertWatch page (saqura.org/en/certwatch).
Frequently asked questions
Does it run on our infrastructure?
Yes. CertWatch is a self-hosted product: a package for Linux (x86-64 and arm64), Windows or macOS that you operate on your own server. For continuous operation we recommend Linux or Windows.
Do our customers see SaQura?
Alerts and reports go to the recipients of each tenant under your brand. You operate CertWatch; your customers never have to log in anywhere.
How many tenants are possible?
The MSP tier counts per tenant: a flat rate up to 10 tenants, each additional one individually, unlimited tenants at a fixed price from 20. The Self-Host annual license includes unlimited addresses; tenants are included.
Does CertWatch renew certificates?
Yes, once you switch it on for a tenant; renewal is off by default. Requirements: certificates from Let's Encrypt, DNS at Cloudflare or Azure DNS, and nginx on Linux or IIS on Windows as the web server. The CertWatch Agent installs the certificate on the web server. CertWatch then checks from the outside whether the new certificate is actually being served, and only then gives the all-clear. Certificates from other issuers are still monitored; their renewal stays with your panel, your certificate authority or your ACME client.
Which data leaves our premises?
Findings and inventory stay with you. Two outbound connections can be switched off: the daily license check with KyotoTech in all licensed plans (transmitted are the product identifier, a checksum of the license number, the issue date of your license and your setting for license e-mails; trial mode does not ask) and the check for new versions. The checks themselves run from your server: to the monitored addresses, to the issuers' revocation lists and to the public certificate logs. If automatic renewal is switched on, CertWatch also connects to Let's Encrypt and your DNS provider.
Want to see a sample report?
We will send you a sample report as your customer would receive it under your brand. Just ask us about running CertWatch on your platform.